GitHub Pupy

Pupy can execute Lazagne as well as Mimikatz using PowerShell.

Pupy can use Lazagne for harvesting credentials.

Pupy can use Lazagne for harvesting credentials.

Pupy has built in commands to identify a host’s IP address and find out other network configuration settings by viewing connected sessions.

Pupy can enable/disable RDP connection and can start a remote desktop session using a browser web socket client.

Pupy can enumerate local information for Linux hosts and find currently logged on users for Windows hosts.

Pupy can send screenshots files, keylogger data, files, and recorded audio back to the C2 server.

Pupy has a built-in module for port scanning.

Pupy has a built-in utility command for netstat, can do net session through PowerView, and has an interactive shell which can be used to discover additional information.

Pupy can migrate into another process using reflective DLL injection.

Pupy uses a keylogger to capture keystrokes it then sends back to the server after it is stopped.

Pupy can list the running processes and get the process ID and parent process’s ID.

Pupy has a module for loading and executing PowerShell scripts.

Pupy can use an add on feature when creating payloads that allows you to create custom Python scripts (“scriptlets”) to perform tasks offline (without requiring a session) such as sandbox detection, adding persistence, etc.

Pupy can communicate over HTTP for C2.

Pupy can grab a system’s information including the OS version, architecture, etc.

Pupy can walk through directories and recursively search for strings in files.

Pupy uses PowerView and Pywerview to perform discovery commands such as net user, net group, net local group, etc.

Pupy can upload and download to/from a victim machine.

Pupy can drop a mouse-logger that will take small screenshots around at each click and then send back to the server.

Pupy can interact with a victim’s Outlook session and look through folders and emails.

Pupy can record sound with the microphone.

Pupy can access a connected webcam and capture pictures.

Pupy can obtain a list of SIDs and provide the option for selecting process tokens to impersonate.

Pupy can list local and remote shared drives and folders over SMB.

Pupy can user PowerView to execute “net user” commands and create local system accounts.

Pupy can user PowerView to execute “net user” commands and create domain accounts.

Pupy has a module that checks a number of indicators on the system to determine if its running on a virtual machine.

Pupy can be used to establish persistence using a systemd service.

Pupy adds itself to the startup folder or adds itself to the Registry key SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run for persistence.

Pupy can bypass Windows UAC through either DLL hijacking, eventvwr, or appPaths.

Pupy can also perform pass-the-ticket.

Pupy can use Lazagne for harvesting credentials.

Pupy can use Lazagne for harvesting credentials.

Pupy can use Lazagne for harvesting credentials.

Pupy can sniff plaintext network credentials and use NBNS Spoofing to poison name services.

Pupy can compress data with Zip before sending it over C2.

Pupy uses PsExec to execute a payload or commands on a remote host.

Pupy's default encryption for its C2 communication channel is SSL, but it also has transport options for RSA and AES.

Pupy has a module to clear event logs with PowerShell.